skills.rest
omeraltn
omeraltnCOMMUNITY
Explore all skills by this author →
GitHub

agency-threat-detection-engineer

Automate SIEM detection rule development and MITRE ATT&CK mapping.

Updated Apr 11, 2026
Search Tags:#detection#siem#threat-hunting#sigma#mitre#detection-as-code#alert-tuning
One-click install
npx skills add https://github.com/omeraltn/ice_cream_website_testing --skill agency-threat-detection-engineer-omeraltn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: agency-threat-detection-engineer
Source: https://github.com/omeraltn/ice_cream_website_testing/tree/main/.antigravity/agency-threat-detection-engineer
Command: npx skills add https://github.com/omeraltn/ice_cream_website_testing --skill agency-threat-detection-engineer-omeraltn

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security operations teams struggle to design, implement, and maintain high-fidelity SIEM detections that map to MITRE ATT&CK, while reducing alert fatigue and operational debt.

Core Features & Use Cases

  • Sigma-based detection rule development and CI/CD deployment to multiple SIEMs
  • MITRE ATT&CK coverage mapping and risk-based detection roadmaps
  • Threat hunting support and hunting-to-detection conversion
  • Continuous detection tuning and alert management for SOC resilience
  • Detection-as-code pipelines from Git to SIEM

Quick Start

Provide a starter SOC environment description to generate an initial MITRE-mapped detection rule.

Frequently Asked Questions about agency-threat-detection-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate SIEM rule development and map detections to MITRE ATT&CK?▼

Automate SIEM rule development by generating Sigma-based detections and mapping them directly to MITRE ATT&CK techniques. This workflow includes creating descriptive metadata, data source documentation, and validation tests to ensure high-fidelity alert coverage.

What is detection-as-code and how does it apply to threat hunting workflows?▼

Detection-as-code applies to threat hunting by converting manual hunting queries into versioned, deployable Sigma rules. This pipeline pushes detections from Git to your SIEM, bridging the gap between proactive hunting and automated alert generation.

Can I use Sigma rules for continuous alert tuning and SOC fatigue reduction?▼

Yes, you can use Sigma rules for continuous alert tuning to reduce SOC fatigue. The workflow supports ongoing detection management, helping security operations teams maintain high-fidelity alerts and minimize operational debt over time.

What is the best way to build a MITRE-mapped detection roadmap for my SIEM?▼

Build a MITRE-mapped detection roadmap by assessing your current ATT&CK coverage and identifying gaps. Provide a starter SOC environment description to generate an initial rule, then prioritize risk-based detection development across your data sources.

Do I need a CI/CD pipeline to deploy detection rules to multiple SIEMs?▼

A CI/CD pipeline is required to deploy detection rules to multiple SIEMs. The detection-as-code workflow manages rule deployment from Git repositories, ensuring validation tests and deployment readiness checks pass before reaching production environments.

Related Skills

Explore More Software Engineering Skills→
UnitOneAIUnitOneAI
44

detection-engineering

Generate Sigma detection rules and Palantir ADS documentation for MITRE ATT&CK v16 techniques.

Official
Advanced
rajyeole6rajyeole6

agency-threat-detection-engineer

Automate Sigma detection rule validation and deployment for SIEM platforms.

Community
Advanced
AdawoduAdawodu

engineering-threat-detection-engineer

Automate Sigma SIEM rule creation, MITRE ATT&CK mapping, and detection-as-code pipelines.

Community
Advanced
jay6697117jay6697117

agency-threat-detection-engineer

Author Sigma detection rules and validate them through CI/CD pipelines.

Community
Advanced